An American nonprofit mental health and behavioral health services provider has been notifying patients of a recent cyber-attack that exposed the protected health information (PHI) of more than 295,000 patients.
AspenPointe, which is based in Colorado Springs, Colorado, was successfully targeted by cyber-criminals in September 2020. The attack forced the healthcare provider to take its systems offline, causing several days of operational disruption.
"We recently discovered unauthorized access to our network occurred between September 12, 2020 and approximately September 22, 2020," said AspenPointe in a notification letter sent out to patients on November 19.
"We immediately launched an investigation in consultation with outside cybersecurity professionals who regularly investigate and analyze these types of situations to analyze the extent of any compromise of the information on our network."
The investigation, which concluded on November 10, found that cyber-criminals had been able to access patient data that included full names, dates of birth, driver's license numbers, bank account information, Social Security numbers, Medicaid ID numbers, dates of visitations, admissions dates, discharge dates, and/or diagnosis codes.
"To date, we are not aware of any reports of identity fraud or improper use of your information as a direct result of this incident," said AspenPointe.
The security breach was reported to Health and Human Services' Office for Civil Rights on November 19 as affecting 295,617 individuals. AspenPointe is offering 12 months of complimentary identity theft protection services and a $1m insurance reimbursement policy to those affected.
The healthcare provider said that following the attack, it has taken steps to improve its cybersecurity, including firewall changes, the implementation of additional endpoint protection, and increased monitoring. A password reset has also been performed.
AspenPointe manages 12 organizations that help thousands of people every year who are suffering from mental health problems, including depression and grief, and also supports individuals with substance misuse issues.
The healthcare provider also offers career services, assisting Colorado Springs residents to develop employment goals and teaching them how to search for and apply to jobs, write a resume, and make a good impression in a job interview.